From b9c4d3799fe9a677693101a0521296c24463a869 Mon Sep 17 00:00:00 2001 From: Luis Blanco Date: Fri, 29 Nov 2024 16:09:37 +0000 Subject: [PATCH 1/6] check firewall added --- spec/configuration/firewall_spec.rb | 36 +++++++++++++++++++++++++++++ spec/services/firewalld_spec.rb | 13 +++++++++++ 2 files changed, 49 insertions(+) create mode 100644 spec/configuration/firewall_spec.rb create mode 100644 spec/services/firewalld_spec.rb diff --git a/spec/configuration/firewall_spec.rb b/spec/configuration/firewall_spec.rb new file mode 100644 index 0000000..77c4974 --- /dev/null +++ b/spec/configuration/firewall_spec.rb @@ -0,0 +1,36 @@ +# frozen_string_literal: true + +require 'spec_helper' +require 'set' + +set :os, family: 'redhat', release: '9', arch: 'x86_64' + +describe 'Check zones are defined' do + describe file("/etc/firewalld/zones/public.xml") do + it { should exist } + it { should be_owned_by 'root' } + it { should be_grouped_into 'root' } + # it { should be_mode 600 } # Ensures file is readable and writable by root only + end +end + +describe 'Check if not allowed open ports in public zone are empty' do + valid_public_ports = Set.new [ + '5353/udp', #(mDNS / Serf) + '161/udp', #(snmp) + '162/udp', #(snmp) + ] + + open_public = command('firewall-cmd --zone=public --list-ports') + open_public = open_public.stdout.strip.split(' ') + open_public = Set.new open_public + + not_allowed_open_public = open_public - valid_public_ports + + it 'should not have any not allowed open ports in public zone' do + unless not_allowed_open_public.empty? + fail "Not allowed open ports in public zone: #{not_allowed_open_public.to_a.join(', ')}" + end + expect(not_allowed_open_public).to be_empty + end +end diff --git a/spec/services/firewalld_spec.rb b/spec/services/firewalld_spec.rb new file mode 100644 index 0000000..304b5b3 --- /dev/null +++ b/spec/services/firewalld_spec.rb @@ -0,0 +1,13 @@ +# frozen_string_literal: true + +require 'spec_helper' +set :os, family: 'redhat', release: '9', arch: 'x86_64' + +describe service('firewalld') do + it { should be_running } + it { should be_enabled } +end + +describe command('firewall-cmd --reload') do + its(:exit_status) { should eq 0 } +end \ No newline at end of file From 241064d64fb03393a1691adb2a31f0c1c05eb0f6 Mon Sep 17 00:00:00 2001 From: Luis Blanco Date: Thu, 5 Dec 2024 11:54:03 +0000 Subject: [PATCH 2/6] lint and skip instead of fail --- spec/configuration/firewall_spec.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/spec/configuration/firewall_spec.rb b/spec/configuration/firewall_spec.rb index 77c4974..63de988 100644 --- a/spec/configuration/firewall_spec.rb +++ b/spec/configuration/firewall_spec.rb @@ -6,7 +6,7 @@ set :os, family: 'redhat', release: '9', arch: 'x86_64' describe 'Check zones are defined' do - describe file("/etc/firewalld/zones/public.xml") do + describe file('/etc/firewalld/zones/public.xml') do it { should exist } it { should be_owned_by 'root' } it { should be_grouped_into 'root' } @@ -29,8 +29,9 @@ it 'should not have any not allowed open ports in public zone' do unless not_allowed_open_public.empty? - fail "Not allowed open ports in public zone: #{not_allowed_open_public.to_a.join(', ')}" + skip "Not allowed open ports in public zone: #{not_allowed_open_public.to_a.join(', ')}" end + expect(not_allowed_open_public).to be_empty end -end +end From 3467e99667659034728f55626d403b0f75ff1dee Mon Sep 17 00:00:00 2001 From: Luis Blanco Date: Thu, 5 Dec 2024 11:56:19 +0000 Subject: [PATCH 3/6] lint --- spec/configuration/firewall_spec.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/spec/configuration/firewall_spec.rb b/spec/configuration/firewall_spec.rb index 63de988..ad924bf 100644 --- a/spec/configuration/firewall_spec.rb +++ b/spec/configuration/firewall_spec.rb @@ -16,9 +16,9 @@ describe 'Check if not allowed open ports in public zone are empty' do valid_public_ports = Set.new [ - '5353/udp', #(mDNS / Serf) - '161/udp', #(snmp) - '162/udp', #(snmp) + '5353/udp', # (mDNS / Serf) + '161/udp', # (snmp) + '162/udp', # (snmp) ] open_public = command('firewall-cmd --zone=public --list-ports') From 6057d2403b4f3d6be86e39c5a7f219e2d61593d6 Mon Sep 17 00:00:00 2001 From: Luis Blanco Date: Thu, 5 Dec 2024 12:08:43 +0000 Subject: [PATCH 4/6] lint --- spec/configuration/firewall_spec.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/spec/configuration/firewall_spec.rb b/spec/configuration/firewall_spec.rb index ad924bf..590eded 100644 --- a/spec/configuration/firewall_spec.rb +++ b/spec/configuration/firewall_spec.rb @@ -18,7 +18,7 @@ valid_public_ports = Set.new [ '5353/udp', # (mDNS / Serf) '161/udp', # (snmp) - '162/udp', # (snmp) + '162/udp' # (snmp) ] open_public = command('firewall-cmd --zone=public --list-ports') @@ -29,6 +29,7 @@ it 'should not have any not allowed open ports in public zone' do unless not_allowed_open_public.empty? + # Better to use 'skip' instead of 'fail' to not block the pipeline skip "Not allowed open ports in public zone: #{not_allowed_open_public.to_a.join(', ')}" end From 30e8cb7dce98f16a50f2b72257b70a3e37c4b193 Mon Sep 17 00:00:00 2001 From: Luis Blanco Date: Thu, 5 Dec 2024 12:14:25 +0000 Subject: [PATCH 5/6] lint --- spec/configuration/firewall_spec.rb | 2 +- spec/services/firewalld_spec.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/configuration/firewall_spec.rb b/spec/configuration/firewall_spec.rb index 590eded..3b5872f 100644 --- a/spec/configuration/firewall_spec.rb +++ b/spec/configuration/firewall_spec.rb @@ -10,7 +10,7 @@ it { should exist } it { should be_owned_by 'root' } it { should be_grouped_into 'root' } - # it { should be_mode 600 } # Ensures file is readable and writable by root only + # it { should be_mode 600 } # Ensures file is readable and writable by root only end end diff --git a/spec/services/firewalld_spec.rb b/spec/services/firewalld_spec.rb index 304b5b3..79a3324 100644 --- a/spec/services/firewalld_spec.rb +++ b/spec/services/firewalld_spec.rb @@ -10,4 +10,4 @@ describe command('firewall-cmd --reload') do its(:exit_status) { should eq 0 } -end \ No newline at end of file +end From 239dddee71e39dfbc11840445dfeccd6e92046d9 Mon Sep 17 00:00:00 2001 From: Luis Blanco Date: Thu, 5 Dec 2024 12:15:39 +0000 Subject: [PATCH 6/6] lint --- spec/configuration/cgroup_spec.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/spec/configuration/cgroup_spec.rb b/spec/configuration/cgroup_spec.rb index 6711961..be1f897 100644 --- a/spec/configuration/cgroup_spec.rb +++ b/spec/configuration/cgroup_spec.rb @@ -5,11 +5,10 @@ cgroups = command('find /sys/fs/cgroup/redborder.slice -type d -name "redborder-*" -not -name "*.service"').stdout.split +describe file('/sys/fs/cgroup/redborder.slice') do + it { should exist } +end describe 'Check cgroups' do - describe file('/sys/fs/cgroup/redborder.slice') do - it { should exist } - end - cgroups.each do |cgroup| next if cgroup.include?('snortd') || cgroup.include?('barnyard2')